Understand user affiliation

When users are affiliated with the organization managing their Chrome browser, they are viewed as more trustworthy. Organizations place more restrictions on users that sign into browsers or ChromeOS devices that are not affiliated with the user's domain.

A Chrome browser user is affiliated if all the following conditions are met:

• the Chrome browser is managed through Chrome Enterprise Core
• AND the user is managed through Google Cloud Identity
• AND the user and the managed browser belong to the same organization

A ChromeOS user is affiliated if all the following conditions are met:

• the ChromeOS device is managed 
• AND the ChromeOS user is managed
• AND the user and the managed device belong to the same organization

In most instances, affiliated users belong to one domain registered for Chrome Enterprise Core. However, organizations can configure multiple domains to represent one organization. In this case, affiliated users can belong to multiple domains.

Example scenarios

Here are some scenarios when a user signs into a device.

Example 1

Scenario

• [e-mail] is managed by domainA
• The device is managed by domainA

Result 

• [e-mail] is affiliated

Example 2

Scenario

• [e-mail] is managed by domainA
• The device is unmanaged

Result 

• [e-mail] is not affiliated

Example 3

Scenario

• [e-mail] is managed by domainA
• The device is managed by domainB

Result

• [e-mail] is not affiliated

Note: This scenario is used to turn off some Google Cloud Services that require user affiliation.

Example 4

Scenario

• [e-mail] is managed by domainB
• The device is managed by domainB

Result 

• [e-mail] is affiliated

Verify user affiliation

1. On a managed Chrome browser or ChromeOS device, browse to chrome://policy.
2. If a managed user is signed in, a User policies box is displayed under Status.
3. The Is affiliated status should be set to Yes.

Related topics

• Set Chrome policies for users or browsers
• Essentials editions